Privacy

HAGMAN AS, Norwegian company number 991 626 220, is the data controller. Business address: Njærheimvegen 81, 4356 Nærbø. Hexis Design is the trading name we use publicly.

Questions about privacy can be sent to post@hexisdesign.no or 458 34 265.

What you fill in yourself in the demo request, public information about the business, and your IP address when you fetch available times and send the request:

• Your name.
• Email address. That is where we send the draft and the meeting confirmation.
• Phone number. That is where we send an SMS with the time and links to change or cancel.
• One sentence about what the business does.
• Optional details under "More options": current website, social media, what the site should achieve, a style you like, references and which add-ons you are considering.
• The time you pick for the demo meeting.
• The time zone your browser reports, and how long you spent filling in the form. The time zone is passed on to Cal.com so the confirmation shows the time where you are. The duration is used only to tell a person from a script, and is not stored anywhere.
• Public information about the business that we need for the draft, such as the name of the business, copy, images, opening hours and contact details from its website, social media and listings about the business. We collect it from public pages with the help of AI, and use it only for the draft.
• Your IP address, when you fetch available times and when you submit the form. It is used only to count attempts, so the form cannot be misused to fill the calendar or send SMS messages in a loop. We do not store the address itself, only a fingerprint of it in the server’s memory, as described below.

To prevent misuse, the server counts attempts. It does not store the IP address, email address or phone number, only a fingerprint: a code computed from the value and a secret key that is created anew each time the server starts. The fingerprints exist only in the server’s memory. There are three of them:

• When you fetch available times: a fingerprint of the IP address. The limit is 30 fetches per minute, and each attempt is counted for one minute.
• When you submit the form: a fingerprint of the IP address. The limit is five submissions per ten minutes, and each attempt is counted for ten minutes.
• When you submit the form: a fingerprint of the email address and of the phone number. The limit is three booking attempts per hour per email address and per phone number, and each attempt is counted for one hour.

When the time is up, the fingerprint is removed the next time the server counts an attempt of the same kind, or when the server stops. The fingerprints are never written to any database, are not stored with your request, and we do not use them to find out who you are.

We measure how many people visit the pages, where they came from, and how quickly the pages load. The measurement is cookie-free: it sets no cookies, does not follow you between websites and builds no profile of you.

We see numbers, not people.

We also use Google Tag Manager, with Google Analytics for statistics and Google Ads for advertising. Tag Manager is loaded from Google on every page before you have answered, so Google receives your IP address, details about your browser and device, and may learn which page you are on. That happens even if you say no.

Without your yes, storage is denied: the tags we have set up in Tag Manager set no cookies and read none. You can say yes to two things, each on its own:

• Statistics. Google Analytics may set cookies that recognise your browser from one visit to the next on this site. We use this to see how the site is used.
• Advertising. Google Ads may set cookies and use details about your visit for two things: measuring whether our ads work, for example whether a demo request came after a click on an ad, and showing you our ads on other websites and in Google’s services. Your name, email, phone number and what you write in the form are not sent to Google.

We do not see who you are, only totals. Google’s cookies last from a few months up to two years. Google Analytics deletes measurements linked to your browser two months after your last visit. Your choice is stored in your browser (localStorage) and can be changed at any time with the button just below, or with the "Cookies" button at the bottom of the other pages. Cookies already set are not deleted when you withdraw consent; remove them in your browser settings.

For advertising, Google decides how the data is used further and is itself responsible for that. How Google uses information from sites that use its services.

Change your choice: Cookies

The details are used to build the clickable draft, arrange the demo meeting and reply to you. If you are the one entering the contract, for example as the owner of a sole proprietorship, the legal basis is steps taken at your request prior to entering a contract, GDPR Article 6(1)(b). If you are asking on behalf of a business or an association, the basis is our legitimate interest in replying to and preparing a contract with those you represent, Article 6(1)(f).

We collect public information about the business because you have asked for a draft, and it is needed to build it, GDPR Article 6(1)(b) and (f).

Visit numbers rest on a different basis: our legitimate interest in knowing whether the site works, GDPR Article 6(1)(f). Since the measurement is cookie-free and does not identify you, the intrusion is minimal.

We use statistics and advertising from Google only on the basis of your consent, GDPR Article 6(1)(a) and the Norwegian Electronic Communications Act section 3-15. The two consents are given and withdrawn separately, at any time.

Loading Tag Manager before you have answered, so that Google receives your IP address when the page loads, rests on legitimate interest, Article 6(1)(f). The interest is that the measurement and your consent choice work from the first page you open.

The fingerprints that count attempts also rest on Article 6(1)(f): our legitimate interest in preventing the form and the calendar from being misused. They are used for nothing else.

What you write in the form is not used for marketing, profiling or automated decisions, and you receive nothing you have not asked for. The only marketing is our ads on Google. They rest only on your visit, and only if you have said yes to advertising.

If we have agreed it with the customer, for example in the launch offer, we show the website we built in our portfolio: screenshots, company name, logo, link and a short text about the job. If there are people on the website, photos or names of them may be included. If the business is a sole proprietorship, the company name may be your name.

The basis is our legitimate interest in showing our work, GDPR Article 6(1)(f).

You can object. If you are in a photo or named in our portfolio, you can ask us to take you out. We remove the photo or the name within 14 days, and you do not have to say why. If you object and your business is a sole proprietorship, we show the project without anything that points to you: no company name, logo, link or contact details, and no photos of you. If you want the project out of the portfolio entirely, the buy-out in the terms applies.

To run the service we use a few providers who process the details on our behalf:

• Vercel hosts the website, receives the request when you send the form, and provides the cookie-free visit measurement. Vercel logs requests to the site, including the IP address, for a short time for operations and security.
• Cal.com holds the calendar of available times, creates the meeting and sends the confirmation to you and to us. Your phone number is passed on to Twilio, Cal.com’s SMS provider, which sends you the message with the time. That happens every time, not just sometimes.
• Our email and calendar provider receives the confirmation from Cal.com with what you wrote in the form, and stores the meeting in our calendar.
• Google provides Tag Manager, Google Analytics and Google Ads, and receives your IP address when a page loads, even if you say no. If you say yes to statistics, Google Analytics measures your visits for us. If you say yes to advertising, Google Ads uses details about the visit to measure our ads and show you our ads. Google is itself responsible for that use.
• AI service providers which we use to collect public information about the business and to produce copy and design drafts. They receive what you have written about the business and your wishes, and the public information, such as the name of the business.

We sell no personal data, and what you write in the form is not shared with anyone for marketing. Vercel, Cal.com, Twilio and Google are US companies, so data may be transferred to the United States. The basis is the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise the European Commission’s standard contractual clauses. Our email and calendar provider and the AI providers may also process data outside the EEA. You can ask us for a copy of the basis for the transfers.

If nothing comes of it, we delete the request within twelve months. If you become a customer, we keep what we need for as long as the customer relationship lasts. Norwegian accounting law requires vouchers and invoicing records to be kept for five years after the end of the financial year, and we cannot delete those before that deadline.

If you ask for deletion before then, we delete everything we are not legally required to keep. When the customer relationship ends, we may still show the website in our portfolio. We remove personal data from the portfolio when someone objects.

The draft we built is deleted no later than 14 days after delivery if you do not go ahead.

You have the right to

• know what data we hold about you, and receive a copy of it,
• have incorrect data corrected,
• have data deleted where we have no legal duty to keep it,
• ask for processing to be restricted, and to object to it,
• receive the data in a machine-readable format.

Tell us, and we will respond free of charge within one month at the latest. If we need more time, we will tell you within that month and explain why. If you believe we are handling your data incorrectly, you can complain to the Norwegian Data Protection Authority, Datatilsynet.

The example sites we show are fictional businesses, built to show what a finished site can look like. The names, phone numbers, addresses and company numbers there are invented. Demos we build for a specific business are never published without that business saying yes. The demo pages are separate pages shown inside the front page. They have no consent banner or Tag Manager, and load nothing from other websites.